Bump aws-lc-rs to 1.17.0 (aws-lc-sys 0.41.0) to resolve Dependabot alerts

Bumps aws-lc-sys 0.31.0 -> 0.41.0 (via aws-lc-rs 1.14.0 -> 1.17.0),
resolving four high-severity AWS-LC advisories, all requiring >= 0.38/0.39:
- CRL Distribution Point Scope Check Logic Error (needs >= 0.39.0)
- PKCS7_verify Signature Validation Bypass
- Timing Side-Channel in AES-CCM Tag Verification
- PKCS7_verify Certificate Chain Validation Bypass

aws-lc-rs 1.14.0 pinned aws-lc-sys below 0.39, so the parent crate is bumped
rather than aws-lc-sys directly. Both are transitive deps via rustls <- hf-hub.
Cargo.lock-only change (also drops the now-unneeded bindgen build dep).
cargo check --features metal,accelerate passes (native AWS-LC build included).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cpetersen